TerminalFix: Fake CAPTCHA to PNG Steganography and WebSocket Reverse Tunnels

Microsoft has warned of new attacks called TerminalFix that use fake CAPTCHAs to gain access to Windows systems. These attacks involve tricking users into pasting malicious PowerShell commands into their terminals. Once executed, the fake CAPTCHA displays a fake Cloudflare Turnstile page and copies a PowerShell script to the clipboard. When the user pastes the script into the terminal, it extracts a ZIP file to the C:\ProgramData folder and runs a batch file called 1.bat.

The attack is set up to side-load a malicious DLL called dui70.dll from the legitimate LockScreenContentServer.exe process. The PowerShell script then restores the executable and DLL fragments from three PNG images. This creates a Run key and a 60-minute scheduled task, then hides the folder containing the malicious files. The attack then enumerates Active Directory and internal servers to set up a reverse WebSocket tunnel that allows external attackers to communicate with internal network resources.

The fake CAPTCHA display and the malicious PowerShell clipboard copy are the only observable indicators of the attack. The primary entry point for the attackers is compromised websites, which are visited by the user. Once the attack is successful, the compromised endpoint becomes a pivot point for the attackers to move laterally within the internal network, potentially leading to credential theft, lateral movement, and data exfiltration.

To defend against TerminalFix attacks, users should be cautious when presented with fake CAPTCHAs that ask them to paste PowerShell commands into the terminal. Administrators should monitor for suspicious activity such as random-name folders in C:\ProgramData, LockScreenContentServer.exe running from non-standard paths, dui70.dll, PNG file uploads, Run keys, scheduled tasks, and pythonw.exe running client.py.

Network monitoring should also be focused on TLS WebSocket traffic to gitnow.dev:443, which indicates pivot behavior.